CVE-2016-5018

CVE-2016-5018

Critical · published August 10, 2017

CVSS v3.1
9.1
EPSS
10%
Percentile
95.7
In the wild
Unconfirmed
What it is

⚠️ A crafty web application can bypass your SecurityManager with just a few tricks! This vulnerability in Apache Tomcat is a sneaky way through your defenses! 🔥 Think of it like a hotel that has set strict rules about who can access certain areas. Now, imagine an unauthorized guest cleverly finds a way to sneak past the security desk using a staff-only access card left unattended — it’s all too easy! If exploited, a malicious web application could gain access to sensitive resources that should be tightly controlled. This could lead to unauthorized data access or even manipulation of critical application functions — absolutely devastating for your security posture!

Put simply

Think of it like a hotel that has set strict rules about who can access certain areas. Now, imagine an unauthorized guest cleverly finds a way to sneak past the security desk using a staff-only access card left unattended — it’s all too easy! In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, and 6.0.0 to 6.0.45, a utility method accessible to web applications enables them to bypass the configured SecurityManager, which is intended to restrict access to sensitive operations.

What to do

If exploited, a malicious web application could gain access to sensitive resources that should be tightly controlled. This could lead to unauthorized data access or even manipulation of critical application functions — absolutely devastating for your security posture! Update your Apache Tomcat to versions 9.0.0.M10 or 8.5.5 and above to close this bypass risk. Regularly review your security configurations to ensure they align with best practices for application security. 🛡️ You've got this! With the right updates, you'll keep your defenses strong and your applications safe! ✨

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.10303 · 95.7th percentile
Published
2017-08-10T20:29Z
Affected products (33)
ProductVersionsFixed in
apache/tomcat≥ 6.0.0, ≤ 6.0.45—
apache/tomcat≥ 7.0.0, ≤ 7.0.70—
apache/tomcat≥ 8.0, ≤ 8.0.36—
apache/tomcat≥ 8.5.0, ≤ 8.5.4—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
netapp/oncommand_insightall versions—
netapp/oncommand_shiftall versions—
netapp/snap_creator_frameworkall versions—
canonical/ubuntu_linuxall versions—
debian/debian_linuxall versions—
redhat/jboss_enterprise_application_platformall versions—
redhat/jboss_enterprise_web_serverall versions—
redhat/enterprise_linux_desktopall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_serverall versions—
redhat/enterprise_linux_server_ausall versions—
redhat/enterprise_linux_server_ausall versions—
redhat/enterprise_linux_server_ausall versions—
redhat/enterprise_linux_server_tusall versions—
redhat/enterprise_linux_server_tusall versions—
redhat/enterprise_linux_workstationall versions—
oracle/tekelec_platform_distribution≥ 7.4.0, ≤ 7.7.1—
References (60)
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · [email protected]https://security.netapp.com/advisory/ntap-20180605-0001/ · [email protected]https://usn.ubuntu.com/4557-1/ · [email protected]https://www.oracle.com/security-alerts/cpuoct2021.html · [email protected]http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2017-0457.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2017-1551.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3720 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/93942 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037142 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1038757 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:0455 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:0456 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:1548 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:1549 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:1550 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:1552 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:2247 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e%40%3Cannounce.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20180605-0001/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4557-1/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html · [email protected]http://rhn.redhat.com/errata/RHSA-2017-0457.html · [email protected]http://rhn.redhat.com/errata/RHSA-2017-1551.html · [email protected]http://www.debian.org/security/2016/dsa-3720 · [email protected]http://www.securityfocus.com/bid/93942 · [email protected]http://www.securitytracker.com/id/1037142 · [email protected]http://www.securitytracker.com/id/1038757 · [email protected]https://access.redhat.com/errata/RHSA-2017:0455 · [email protected]https://access.redhat.com/errata/RHSA-2017:0456 · [email protected]https://access.redhat.com/errata/RHSA-2017:1548 · [email protected]https://access.redhat.com/errata/RHSA-2017:1549 · [email protected]https://access.redhat.com/errata/RHSA-2017:1550 · [email protected]https://access.redhat.com/errata/RHSA-2017:1552 · [email protected]https://access.redhat.com/errata/RHSA-2017:2247 · [email protected]https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e%40%3Cannounce.tomcat.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E · [email protected]
EPSS history
Timeline
  • 10 AUG 16:00Z
    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass…
    cvelistv5